Exposed Directory Reveals FortiGate and MeshCentral Intrusion Targeting Thai Broadband Provider

Sep 14, 2026 · Original article ↗

Summary

An exposed directory revealed an intrusion targeting 3BB, including exploitation of FortiGate CVE-2024-21762, MeshCentral persistence, connected agents, credential-harvesting tools, and evidence of root-level access.

Key points

Hunt.io found 298 files in an exposed directory containing exploit scripts, credentials-related tools, persistence mechanisms, and an inventory of compromised devices.
The scripts show exploitation of FortiGate SSL-VPN CVE-2024-21762 at mail.3bb.co.th, with a reverse-shell callback to the staging server.
MeshCentral was configured for persistence under the TH-3BB group; the device inventory showed multiple connected agents running with root privileges.
Artifacts indicate root-level compromise of an internal Linux server and reconnaissance and lateral-movement activity across 3BB systems.
Scripts targeted RADIUS databases for credential extraction; the directory also contained a Triple T Broadband OpenVPN certificate and active session tokens for Jasmine-branded systems.
A cleanup script was prepared to erase logs and exploitation artifacts while preserving MeshCentral access.
The report recommends patching FortiGate appliances, auditing unauthorized MeshCentral agents and access, rotating potentially exposed credentials, and preserving forensic evidence.

Article Details

Attack Vectors: The actor fingerprinted the 3BB FortiGate SSL-VPN, tested several vulnerabilities, and prepared a CVE-2024-21762 exploit that used a crafted chunked HTTP request, heap spraying, and a ROP chain to launch a reverse shell.
Scripts attempted credential brute-forcing against the FortiGate VPN and 3BB agent portal, and SSH password spraying against more than 55 internal hosts.
The actor probed the agent portal for session forgery, file-upload weaknesses, SQL injection, path traversal, open redirects, and HTTP request smuggling.
Scripts probed an F5 BIG-IP appliance for known vulnerabilities and targeted an internal Pentaho server with a Ghostcat file-disclosure exploit.
Post-compromise tooling prepared PwnKit and Dirty COW privilege escalation, harvested keys and credentials, targeted RADIUS databases, and used MySQL file operations to deploy web shells and inject SSH keys.
The actor deployed MeshCentral for persistent remote access and prepared a cleanup script to remove logs and exploitation artifacts while retaining persistence.
Defensive Notes: Check FortiGate SSL-VPN exposure to CVE-2024-21762 and update appliances to supported, fully patched firmware.
Review VPN accounts, configuration changes, authentication attempts, and administrative activity for unauthorized access.
Audit MeshCentral installations for unauthorized agents, unexpected WebSocket connections, and unapproved management servers.
Rotate potentially exposed SSH keys, database passwords, VPN certificates, RADIUS credentials, and application secrets.
Review RADIUS servers, VPN services, and identity systems for unauthorized access or credential extraction.
Hunt for hidden SUID binaries, web shells, SSH key changes, unauthorized scheduled tasks, and newly installed remote-management software.
Preserve forensic evidence before remediation when compromise is suspected; the recovered cleanup script was designed to erase logs and artifacts.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`www[.]ayuthayatech[.]com`	Actor-designated MeshCentral management and C2 server for deployed agents.
IPV4	`92[.]63[.]180[.]133`	Attacker VPS hosting the exposed operational toolkit and serving as the CVE-2024-21762 exploit's reverse-shell callback host.